Intezer Turned Malware DNA Into an AI Analyst That Never Clocks Out

Security software is very good at making work for security people. An endpoint tool notices an odd process. A cloud product dislikes a login. An employee forwards a suspicious email. Each one creates an alert, and the alerts line up like customers outside a nightclub whose bouncer has gone home. The security operations center must open them, collect the evidence, decide what happened and close nearly all of them as noise. Intezer sells a machine for doing that first investigation.

It is not, importantly, another detector trying to replace Microsoft Defender, CrowdStrike, SentinelOne or a SIEM. Intezer plugs into those systems. When an alert arrives, its software gathers files, logs, command lines, memory images, URLs, identity records and environmental context. It runs malware analysis, endpoint forensics, behavioral checks, sandboxing and threat-intelligence searches. AI agents reason across the results. False positives can be closed automatically; credible incidents go to a person with the evidence and a proposed response attached.

The company says the median verdict now arrives in under a minute, with fewer than 2 percent of alerts escalated. Those are company-reported figures, not magic constants. Their usefulness depends on the connected data, the rule set and the customer's tolerance for automation. But the operating idea is crisp: humans should review outcomes, not spend their shift gathering screenshots for tickets that were never dangerous.

First, they built Shazam for bad code

Intezer began in 2015 with a stranger and more technical ambition. Itai Tevet and Roy Halevi had worked together on incident response in the Israel Defense Forces. They founded the company with Alon Cohen, the co-founder and former chief executive of CyberArk. Their premise was that malware authors reuse code just as legitimate developers do. If Intezer could break software into small fragments and map those fragments against a vast library of trusted and malicious code, it could recognize a new sample by its family resemblance.

The founders called it genetic malware analysis. Early descriptions compared the product to a virtual security camera; the breezier analogy was Shazam for code. The wonderfully overlarge internal ambition was to become the "Google of binary code." This database helped researchers connect fragments across malware families, attribute campaigns and spot familiar machinery inside supposedly new threats. Intezer's work on WannaCry and NotPetya made the idea legible outside reverse-engineering circles.

That was a useful product, but it lived inside one step of a larger, uglier workflow. A customer that has worked with Intezer since 2018 described the original ritual plainly: analysts manually grabbed files, pushed them to sandboxes and waited. Intezer automated the file analysis and endpoint scan. Then the customer wanted incident scanning, enrichment and alert triage too. The first thing to fail was not the code-DNA thesis. It was the human handoff around it.

“Before Intezer, we'd manually grab files, push them to sandboxes, and wait for results. Now, everything's done within a minute.”An unnamed multinational customer, after seven years with the company

That demand changed the company's center of gravity. By late 2023, Intezer stopped selling plans limited to on-demand file and website scanning and concentrated its commercial offer on SOC automation. The hard-won forensic engine stayed. The product moved up a level, from telling an analyst what a file was to telling a security team what an incident meant.

A fluent answer is not forensic evidence

The AI SOC category is crowded with products that summarize alerts, recommend playbooks or promise a digital Tier 1 analyst. Intezer's useful distinction is architectural. Large language models are good at connecting context, choosing tools and writing an intelligible narrative. They are also probabilistic. A memory scan, file hash, process tree or code-reuse match is not. Intezer combines the two: agents decide what to examine and interpret the findings, while deterministic tools provide the ground under the verdict.

That distinction matters because the task is not merely to sound right. Auto-closing the wrong alert can hide an intrusion; isolating the wrong machine can stop a business process. Intezer lets customers challenge verdicts, see why the system decided and tune its behavior to local risk. Its newer Org Brain product stores the unwritten context a veteran analyst accumulates - which build server is always noisy, which user normally logs in from Portugal, how this team treated a similar case last month. In July 2026 the company began rolling it out as a memory system that learns from each investigation rather than a static onboarding file.

A month later came Workflows, a native response builder. A customer can describe a procedure in ordinary language, inspect the resulting logic and trigger it from a verdict, schedule or webhook. Deterministic steps handle predictable work: close the source alert, isolate the host, update the ticket, notify the analyst. Generative agents remain available for open-ended work such as incident summaries and threat hunts. It is a sensible division. Do not pay an AI to improvise where an if-then rule will do.

Fifty thousand dollars, or one very tired night shift

Intezer does not publish a neat per-seat menu. Its AWS Marketplace listing shows a $50,000 price for one 12-month contract tier, with longer commitments available. The main pricing unit is protected endpoints rather than alerts. That choice makes the monthly bill predictable when an incident or a badly tuned rule sends volume upward. It also aligns the company with the size of the environment instead of charging extra for the very noise it promises to remove.

The number is substantial for a small company. For an enterprise comparing it with 24-hour analyst staffing, outsourced MDR coverage or a separate SOAR implementation, the arithmetic changes. RSM says the platform saves about $2 million annually. DPD Poland reports more than 2,500 hours saved. CarbonHelix says investigation time fell by nearly 90 percent. Legato Security used it to triage 624,000 alerts in 90 days. Those are vendor-published customer results and should be treated as cases, not universal forecasts. They are still more useful than a foggy claim about "productivity."

Intezer's scale is moving quickly. It reported processing 5.4 million alerts across more than 500 customer environments in 2024, then more than 25 million in 2025. It says it now serves over 150 enterprises, including 15 Fortune 500 companies. Named users include NVIDIA, MGM Resorts, Equifax, Salesforce and Ferguson. That list tells you the intended buyer: a real security organization with a noisy stack, meaningful exposure and enough repetitive work to automate.

Keep the weird advantage; move it nearer the bill

There is a clean founder lesson in Intezer's evolution. The company did not throw away its difficult technical asset when standalone malware scanning proved too narrow. It moved that asset closer to an expensive operational bottleneck. Code DNA became one source of evidence inside a broader investigation product. A tool used by specialists became a workflow used on every alert.

A smaller company can copy the sequence without copying cybersecurity. Start with one manual handoff whose inputs are knowable and whose outcome can be checked. Automate the evidence collection before automating judgment. Make the machine show its work. Use deterministic logic for repeatable actions and generative reasoning only where the task is genuinely open. Finally, price against a stable customer measure, not a volatile symptom the product is meant to control.

The boundaries are equally instructive. Intezer is a weak fit when a company has little alert volume, no functioning SOC or poor data from its security tools. It cannot investigate evidence it cannot collect. A novel attack, ambiguous business context or high-impact response may still need an experienced person. Organizations also need clear authority: who may isolate a host, disable an account or accept an automated closure? Without that governance, fast software simply reaches an indecision sooner.

The product is strongest when the customer already has detectors, data and skilled people - but no longer has enough hours.The practical buying test

Competition will be fierce. Dropzone AI, Prophet Security, Radiant Security, Simbian, Exaforce and 7AI are chasing related work. MDR firms sell human-backed coverage. Microsoft, CrowdStrike, Palo Alto Networks and SentinelOne can build more automation into platforms customers already own. Intezer's defense is the depth of its forensic machinery, more than 100 integrations and a decade of malware research. Its risk is that the giants make "good enough" investigation part of the bundle.

For now, the company occupies a useful middle layer. It is above the products that ring the alarm and below the people accountable for the response. That is not glamorous territory. It is where the queue lives, where salaries pile up and where low-severity signals get ignored. Intezer's bet is that an AI analyst earns trust not by talking like the smartest person in the room, but by returning with the file, the process tree, the memory trace and a verdict before the coffee cools.